Senior Cloud Platform / DevSecOps Engineer

Position Summary

We are seeking a skilled Senior Cloud Platform / DevSecOps Engineer to architect, automate, secure, and manage enterprise-level cloud platforms for Foresight Edge and our clientele.

This role demands robust hands-on expertise in Infrastructure-as-Code, cloud governance, identity management, networking, Kubernetes, CI/CD, GitOps, security protocols, observability, backup/disaster recovery, as well as cloud PaaS and data services.

The ideal candidate will possess the confidence to oversee infrastructure from design and Infrastructure-as-Code through deployment, security, observability, operational management, and disaster recovery.

This engineering position is tailored for someone who can work autonomously, resolve intricate platform challenges, and collaborate closely with teams focused on application, data, analytics, security, and client infrastructure.

Core Responsibilities

Cloud Infrastructure & Infrastructure-as-Code

 Design, construct, and oversee cloud infrastructure utilizing Terraform (experience with Terragrunt or similar orchestration tools is a plus).

 Create reusable, well-documented modules and patterns, incorporating verified/community modules as necessary.

 Maintain distinct environment-specific infrastructure configurations via Git-based workflows.

 Promote Infrastructure-as-Code standards, including peer reviews, testing, and automation.

Cloud Governance & Identity

 Establish and manage cloud governance controls, which include:

o Management group/account hierarchy

o Policy-as-code and compliance guardrails

o Role-based access control (RBAC)

o Privileged access management (e.g., Azure PIM)

 Design secure enterprise landing zones and subscription/account frameworks.

 Oversee identity and access management through Microsoft Entra ID (or equivalent) — managing groups, app registrations, service principals, and enterprise applications.

 Implement OIDC and workload identity federation for passwordless automation and workloads.

Cloud Networking

 Design and support enterprise-level cloud networking, including:

o Hub-and-spoke network architectures

o Cloud firewalls and network security groups

o Private DNS

o Private Link / Private Endpoints

o Hybrid connectivity (ExpressRoute, VPN gateways)

o Application gateways and Web Application Firewalls (WAF)

 Establish secure network segmentation and connectivity across cloud and on-premises environments.

 Troubleshoot routing, DNS, firewall, and private connectivity challenges.

Kubernetes & Container Platform Engineering

 Design and manage secure, private Kubernetes clusters (preferably AKS; EKS/GKE also applicable).

 Configure cluster networking (CNI), node pools, workload identity, ingress, and storage/CSI drivers.

 Apply Kubernetes security, scaling, resilience, and operational best practices.

 Package and deploy applications and platform components using Helm.

 Oversee certificate lifecycle management through tools like cert-manager.

 Troubleshoot Kubernetes workloads, networking, storage, ingress, and cluster-level issues.

CI/CD, GitOps & Developer Platform

 Manage source control platforms (e.g., GitHub) — overseeing organisations, repositories, access controls, and branch protections.

 Create and sustain CI/CD pipelines using GitHub Actions, Azure DevOps, or similar tools.

 Configure and operate self-hosted build runners/agents as needed.

 Implement container build, scanning, and release pipelines.

 Deploy and manage workloads through GitOps tools such as ArgoCD or Flux.

 Establish promotion strategies across development, testing, staging, and production environments.

 Implement secure secrets and configuration management within CI/CD workflows.

Cloud PaaS & Data Platform Services

Hands-on experience in managing and automating cloud services such as:

 Container registries and secrets/key management (e.g., Azure Container Registry, Key Vault)

 Managed relational databases (e.g., PostgreSQL, SQL Server)

 NoSQL/document databases (e.g., Cosmos DB, MongoDB)

 Data lakes and object storage (e.g., ADLS Gen2, Blob Storage)

 Data integration and streaming services that support analytics workloads (e.g., Data Factory, Kafka, Spark-based platforms)

 PaaS networking and Private Endpoints

 Backup, migration, and data movement tools

Assist with data migration activities and the infrastructure necessary for enterprise data and analytics workloads.

Observability & Operations

 Implement comprehensive monitoring using tools such as:

o OpenTelemetry

o Grafana / Prometheus

o Azure Monitor / Log Analytics (KQL)

 Construct dashboards, alerts, and operational health monitoring.

 Implement distributed tracing, metrics, and centralized logging.

 Conduct root cause analysis for platform and application incidents.

 Continuously enhance platform reliability, performance, and availability.

Backup, Restore & Disaster Recovery

 Implement Kubernetes backup and restore using tools like Velero.

 Configure database Point-in-Time Recovery (PITR) and backup strategies.

 Design and validate backup, recovery, and disaster recovery processes.

 Conduct restore testing and create documentation for recovery runbooks.

 Ensure workloads comply with required RPO and RTO objectives.

Security & DevSecOps

 Integrate security protocols throughout infrastructure and deployment pipelines.

 Utilize security scanning tools (e.g., Snyk, Trivy, Checkov, SonarQube) across:

o IaC scanning

o SAST

o Software Composition Analysis (SCA)

o Container image security

 Enforce Kubernetes policies using tools like OPA/Gatekeeper or Kyverno.

 Configure and manage application and network security, including WAF rules.

 Apply least-privilege access, secure secret handling, identity-based authentication, and policy-driven governance.

 Ensure compliance with client and industry standards in regulated sectors (e.g., finance, healthcare, public sector).

DNS, Edge & Application Access

 Oversee DNS and edge services (e.g., Cloudflare, Azure Front Door, Azure DNS) through Terraform, including:

o DNS zones and records

o Secure tunnels and zero-trust application access

o Edge WAF and DDoS protection

o Global load balancing

 Automate DNS and edge-security configurations via Infrastructure-as-Code.

 Troubleshoot DNS resolution, certificates, edge connectivity, and application access issues.

Automation & Scripting

Strong practical skills in:

 Bash and/or PowerShell (Python is a plus)

 Cloud CLIs (e.g., Azure CLI)

 kubectl and Helm CLI

 Git

 Terraform CLI

Utilize scripting and automation to minimize manual operational tasks and enhance platform consistency.

Essential Skills & Experience

 7+ years of experience in Cloud Engineering, Platform Engineering, DevOps, or SRE roles.

 Extensive hands-on experience with at least one major cloud platform — Microsoft Azure preferred; AWS or Google Cloud also appreciated.

 Advanced expertise in Terraform / Infrastructure-as-Code.

 Strong understanding of cloud governance and enterprise landing-zone principles.

 Practical Kubernetes experience in production environments (AKS, EKS, or GKE).

 Proficient in CI/CD and GitOps methodologies.

 Solid grasp of enterprise networking and security.

 Strong experience with cloud identity and access management (e.g., Entra ID).

 Experience with observability, monitoring, and troubleshooting in production settings.

 Hands-on knowledge of security scanning and DevSecOps methodologies.

 Experience managing production-grade platforms within enterprise environments.

Desirable Experience

 Relevant cloud certifications such as:

o Azure Solutions Architect Expert / Azure DevOps Engineer Expert / Azure Security Engineer

o AWS Solutions Architect / DevOps Engineer – Professional

o Google Professional Cloud Architect / DevOps Engineer

 Kubernetes certifications like CKA / CKAD / CKS.

 Experience supporting extensive, regulated, or mission-critical environments.

 Background in a consulting or client-facing delivery role.

 Experience with enterprise data and analytics platforms and cloud migration initiatives.

 Experience collaborating with globally distributed engineering teams.

Personal Attributes

 Strong sense of ownership.

 Excellent troubleshooting and analytical skills.

 Comfortable working independently in complex, multi-client environments.

 Ability to communicate effectively with engineering, security, architecture, business, and client stakeholders.

 Strong emphasis on automation, security, reliability, and operational excellence.

If you are interested, please send your updated CV to [HIDDEN TEXT]